<?php

/**
 * This file is part of ossecdb-extjs.
 * 
 * Copyright (C) 2011 Brendan Johnston
 * 
 * Contact: brendan@johnston.net.au
 * 
 * Project: http://code.google.com/p/ossecdb-extjs/
 * 
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 * 
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 * GNU General Public License for more details.
 * 
 * You should have received a copy of the GNU General Public License
 * along with this program. If not, see <http://www.gnu.org/licenses/>.
 */

class ossec_filter
{
	static function level ($filter)
	{
		global $queries;

		return $queries->alert_col['level'] . ' >= ' . max(
			array_map(
				'intval', $filter->value
			)
		);
	}

	static function src_ip ($filter)
	{
		return self::ip('src_ip', $filter);
	}

	static function dst_ip ($filter)
	{
		return self::ip('dst_ip', $filter);
	}

	static function ip ($field, $filter)
	{
		$octets = explode('.', $filter->value);
		
		for ($i = 0; $i < 4; $i++)
		{
			if (!isset($octets[$i]) || $octets[$i] == '' || $octets[$i] == '*')
			{
				$octets[$i] = '%';
			}
		}

		global $queries;

		return $queries->alert_map[$field . '_str'] . ' like ' . ossec_db::db()->quote(implode('.', $octets));
	}

}